CVE-2025-23166
HighAdvisory
Published 19 May 2025In the index since 6 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.008
- 55th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 17
- of 17,781 indexed, latest versions
- Container images
- 16
- deployed by those charts
- Fix available
- 2 of 3
- affected packages
Red Hat Security Advisory: nodejs:20 security update
Carried by container images the latest versions of 17 of 17,781 indexed charts deploy, on 16 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| nodejsdeb | 18.13.0+dfsg1-1, 18.19.0+dfsg-6~deb12u1, 18.19.0+dfsg-6~deb12u2, 18.19.1+dfsg-6ubuntu5+6 more | 18.20.4+dfsg-1~deb12u2, 20.19.2+dfsg-1 | 13 |
| nodejsrpm | 1:20.12.2-2.module+el9.4.0+21731+46b5b8a7, 1:20.16.0-1.module+el9.4.0+22197+9e60f127 | 1:20.19.2-2.module+el9.4.0+23180+d266bac7 | 2 |
| nodejs-18apk | 18.20.8-r9 | no fix listed | 1 |
- OSV records
- DEBIAN-CVE-2025-23166RHSA-2025:8902UBUNTU-CVE-2025-23166CGA-72rv-6459-558x
- Also known as
- CGA-f37p-f56r-gcf6
Charts affected
17 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| iobrokereugen | 0.2.6 | 1 of 1See more | 11,458 |
| difykubeblocksVerified publisher | 0.5.1 | 1 of 5See more | 20,403 |
| vaultwarden-kubernetes-secretsvaultwarden-kubernetes-secrets | 0.0.0-main | 1 of 2See more | 4,010 |
| node-appbryopsida | 0.5.1 | 1 of 2See more | 14,352 |
| arbitrumchronicleVerified publisher | 0.3.4 | 1 of 1See more | 6,998 |
| codehubcodehubVerified publisher | 6.2.18 | 1 of 5See more | 13,220 |
| difydify | 1.0.0 | 1 of 4See more | 19,224 |
| dominodomino-iisasVerified publisher | 0.3.1 | 1 of 3See more | 10,270 |
| arbitrumdysnixVerified publisher | 0.1.1 | 1 of 1See more | 9,244 |
| scanservjsgabe565Verified publisher | 0.9.2 | 1 of 1See more | 13,241 |
| deconzjanip81-helm-chartsVerified publisher | 0.1.1 | 1 of 1See more | 10,780 |
| k8s-dev-podk8s-dev-pod | 0.3.1 | 1 of 1See more | 8,811 |
| kubiya-runnerkubiya-helm-chartsOfficialVerified publisher | 0.9.4 | 1 of 9See more | 20,204 |
| chatbot-ai-sampleopenshift | 0.1.6 | 2 of 4See more | 18,922 |
| coolifyquench-coolifyVerified publisher | 0.0.17 | 1 of 4See more | 433 |
| coolify-realtimequench-coolify-realtimeVerified publisher | 0.0.7 | 1 of 1See more | 306 |
| the0the0Verified publisher | 0.9.8 | 1 of 9See more | 7,248 |
Container images carrying it
16 by charts deploying them
A fixed version is listed for 2 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | 82d0b161161d | nodejs | no fix listed | 2 |
| ghcr.io/ | f128e512c9c0 | nodejs-18 | no fix listed | 2 |
| deconzcommunity/ | 062de2362641 | nodejs | 18.20.4+dfsg-1~deb12u2 | 1 |
| jupyterhub/ | 3974ba945e65 | nodejs | no fix listed | 1 |
| langgenius/ | 066035f93856 | nodejs | 18.20.4+dfsg-1~deb12u2 | 1 |
| langgenius/ | fca918260dd6 | nodejs | 18.20.4+dfsg-1~deb12u2 | 1 |
| offchainlabs/ | 9f779fa84b7b | nodejs | 18.20.4+dfsg-1~deb12u2 | 1 |
| offchainlabs/ | e95865866129 | nodejs | 18.20.4+dfsg-1~deb12u2 | 1 |
| sbs20/ | dad1fd6e9a98 | nodejs | 18.20.4+dfsg-1~deb12u2 | 1 |
| ghcr.io/ | 459010a02aff | nodejs | no fix listed | 1 |
| ghcr.io/ | 13e267ad7d94 | nodejs | no fix listed | 1 |
| ghcr.io/ | ca7dc7362968 | nodejs | 18.20.4+dfsg-1~deb12u2 | 1 |
| ghcr.io/ | 8e53861be292 | nodejs | 18.20.4+dfsg-1~deb12u2 | 1 |
| ghcr.io/ | 757bdd779345 | nodejs | 20.19.2+dfsg-1 | 1 |
| quay.io/ | 70d138997acd | nodejs | 1:20.19.2-2.module+el9.4.0+23180+d266bac7 | 1 |
| quay.io/ | 59fe607dfdf2 | nodejs | 1:20.19.2-2.module+el9.4.0+23180+d266bac7 | 1 |